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The 385 kg Stardust mission was launched on Feb 7, 1999 on a mission to collect samples 
from the tail of comet Wild 2 and from interplanetary space. Stardust returned to Earth in 
the early morning of January 15, 2006. The sample return capsule landed in the Utah Test 
and Training Range (UTTR) southwest of Salt Lake City. Because Stardust was landing on 
Earth, hazard analysis was required by the National Aeronautics and Space Administration, 
UTTR, and the Stardust Project to ensure the safe return of the landing capsule along with 
the safety of people, ground assets, and aircraft. This paper focuses on the requirements 
affecting safe return of the capsule and safety of people on the ground by investigating 
parameters such as probability of impacting on UTTR, casualty expectation, and probability 
of casualty. This paper introduces the methods for the calculation of these requirements and 
shows how they affected mission planning, site selection, and mission operations. By 
analyzing these requirements before and during entry it allowed for the selection of a robust 
landing point that met all of the requirements during the actual landing event. 
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= casualty area 
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DoD 

= Department of Defense 

E c 

= casualty expectation 
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NASA 

= National Aeronautics and Space Administration 
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= population count 

Pc 

= probability of casualty 

PI 

= probability of impact 

RC 

= reduced criterion 
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= reliability 

SRC 

= Sample Return Capsule 

TCM 

= Trajectory Correction Maneuver 
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I. Introduction 


T HE 385 kg Stardust mission was launched on Feb 7, 1999 on a mission to collect samples from the tail of comet 
Wild 2 and from interplanetary space. Stardust returned to Earth with its cosmic booty in the early morning of 
January 15, 2006. The 46 kg and 0.81 m diameter sample return capsule landed in the Utah Test and Training Range 
(UTTR) southwest of Salt Lake City. Figure 1 shows UTTR in dark green, the final GO/NO-GO decision 99% 
landing ellipse in magenta, and the predicted nominal entry ground track in red. Because Stardust was landing on 
Earth, hazard analysis was required by the National Aeronautics and Space Administration (NASA), UTTR, and the 
Stardust Project to ensure the safe return of the landing capsule along with the safety of people, ground assets, and 
aircraft. This paper focuses on the requirements affecting safe return of the capsule and safety of people on the 
ground. These requirements were placed on range safety parameters such as probability of impacting in certain 
areas, landing location, casualty expectation (E c ), and probability of casualty (P c ). These requirements had to be met 
for both successful and failed entry scenarios before Stardust could be cleared for landing. Section 2 describes the 
requirements imposed on the Stardust landing ellipse. Section 3 delves into the successful and failed entry scenarios 
upon which the requirements were placed. Section 4 describes how to calculate the parameters of impact 
probability, casualty expectation, and probability of casualty. Section 5 introduces the mission analysis completed 
to establish hazard sensitivity to the selected target. Section 6 shows how the hazard calculations were integrated 
into real-time GO/NO-GO entry decisions for Stardust and also shows the results for the final ellipses. 
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Figure 1. Illustration of Utah Test and Training Range with 99% Landing Ellipse and Entry 

Trajectory 
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II. Mission Hazard Requirements 

It is an interesting anecdote that the mission requirements before Stardust was launched were only loosely 
established and changed over time after launch. Although there was flexibility in the landing location, the landing 
azimuth would have been more difficult to change if there was a glaring violation of the hazard requirements. The 
landing azimuth turned out to be acceptable, although it did limit the possible landing locations. This situation of 
requirements changing after launch is less likely to occur for future missions landing at UTTR because of the history 
established by Stardust and Genesis (Ref. 1), a mission that landed at UTTR a year and a half before Stardust. 

The mission requirements levied on Stardust by NASA, UTTR, and the Stardust Project are shown in Table 1 
(Ref. 2). This table does not represent all of the requirements imposed on the Stardust entry, but these do represent 
what was determined to be the most important or highest risk criteria. These were derived from the fuller set of 
requirements outlined in Ref. 3 and 4. During Earth return operations “Green Button” meetings (occurring at Entry 
-21.5 hours and Entry -6.5 hours) were held to review whether these requirements were met. These. The Green 
Button was a symbolic button that had to be “pushed” to enable Earth return. In general, a violation of one of the 
requirements at a Green Button meeting led to a NO-GO landing decision, however, in some cases discretion was 
given to the project manager (PM DISCRETION) or a pre-determined anomaly panel (ANOMALY PANEL) as to 
whether Stardust was cleared to land. Operationally, these requirements were also monitored weeks before the 
approach and not just at these two times. For mission planning and acquiring approval for targeting Earth, the 
requirements were analyzed well in advance of the landing. A close-up of the landing area of UTTR is shown in Fig. 
2 and will be referenced for some of the requirements. The requirements are all based on the existence of a statistical 
ensemble of landing points. These landing points were computed from a Monte Carlo analysis of the entry, descent, 
and landing scenario and were statistically reduced to a bivariate normal landing ellipse. This ellipse is defined by a 
longitude/latitude mean landing point, an ellipse azimuth (measured clockwise from due north), and 99% crossrange 
and downrange ellipse axes. More detail is given on the computation of this ellipse in Ref. 5. 

Requirements 1.1 through 1.8 set limits for the casualty expectation and probability of casualty for a successful 
landing scenario. As a quick introduction to the terms, casualty expectation (E c ) is the number of estimated 
casualties of an entry event, and probability of casualty (P c ) is the probability of an entry event injuring an 
individual. More background and description of these terms is given in Section IV. In the requirements casualty 
expectation is noted as a “collective” risk with units of people, and probability of casualty is noted as an 
“individual” probability with no units. The denotation of “public” or “mission” refers to the population database 
used. People who are stationed to support the mission (“mission”) accept more risk, and people who are not 
involved in the mission (“public”) accept less risk. For each parameter, there is a NASA and a UTTR requirement 
because the requirements levied and the population databases approved by each organization are different. 

Requirements 1.9 through 1.16 are the same requirements as 1.1 through 1.8, but for a scenario where the vehicle 
has failed. Because these scenarios are less likely to occur than successful ones, the nominal failure scenario 
criterion from 1.1 to 1.8 have been relaxed (increased) to reflect a 94% spacecraft reliability. The relationship 
between the relaxed criterion (RC), the original criterion (C), and the reliability (R) is shown in Eq. 1. 


RC = 


C 


1 -R 


( 1 ) 


Because multiple failure modes exist, the Stardust Project made the conservative assumption that every failure 
mode must meet this relaxed criterion. Practically, this meant the worst case E c or P c is used from the array of 
failure modes and this is the value compared to the requirement. The less conservative alternative to this approach 
would be to assign a failure probability to each failure mode, and then sum the weighted results. 

Requirement 1.17 states that the mean landing points must be outside of designated Dugway keepout zones 
shown in magenta in Fig. 2. These are used to represent major installations on UTTR in a populated area called 
Dugway. Requirement 2.1 states that 95% of the landing points must be inside the Green Fence. The Green Fence 
represents the border of UTTR with a 2.5 mile offset and is shown in dark green in Fig. 2. Some leeway is given 
with this requirement allowing the ANOMALY PANEL to have some discretion if the nominal ellipse’s probability 
of impact is between 75% and 95% inside the Green Fence. Requirement 3.1 forces the entry flight path angle to be 
within the stated ranges. This requirement is the only entry, descent, and landing criterion that does not relate 
directly to hazard analysis and is just shown for completeness (see Ref. 5 for more detail). Requirement 4.1 forces 
the mean landing point to be inside the orange ellipses in Fig. 2. The ellipses are based on a pre-determined 3 and 6- 
sigma navigation error ellipse centered at the target. The area between the 3 and 6-sigma ellipse became known as 
the “warning track.” 
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Table 1. Hazard Requirements 



Criterion 

Human Safety - Succesful Entry 


1 . 1 Landing points meet UTTR Pc, public individual 

< le-7 

1 .2 Landing points meet UTTR Ec , public collective (people) 

< 3e-5 

1 .3 Landing points meet UTTR Pc, mission individual 

< 3e-6 

1 .4 Landing points meet UTTR Ec, mission collective (people) 

< 3e-4 

1.5 Landing points meet NASA Pc, public individual 

< le-6 

1.6 Landing points meet NASA Ec, public collective (people) 

< le-4 

1.7 Landing points meet NASA Pc, mission individual 

< le-5 

1.8 Landing points meet NASA Ec, mission collective (people) 

< 3e-4 

Human Safety - Failed Entry 


1 .9 Landing points meet UTTR Pc, public individual 

< 1.67e-6 

1.10 Landing points meet UTTR Ec, public collective (people) 

< 5e-4 

1.11 Landing points meet UTTR Pc, mission individual 

< 5e-5 

1.12 Landing points meet UTTR Ec, mission collective (people) 

< 5e-3 

1.13 Landing points meet NASA Pc, public individual 

< 1.67e-5 

1.14 Landing points meet NASA Ec, public collective (people) 

< 1.67e-3 

1.15 Landing points meet NASA Pc, mission individual 

< 1.67e-4 

1.16 Landing points meet NASA Ec, mission collective (people) 

< 5e -3 

Property Damage 


1.17 Center of landing dispersion is outside of all 1 nmi radius UTTR 
property zones 

Yes 

Landing Site 


2.1 Landing points in Acceptable Landing Region above 95% - GO 
below 75% -NO GO 
between above - ANOMALY PANEL 

>95% 

SRC Capability 


3.1 Entry Flight Path Angle within [-8.05°, -8.35°] to 99% - GO 
beyond [-7.83°, -8.57°] to 99% - NO GO 
between above - ANOMALY PANEL 

> 99% 

> 99% 

Warning Track 


4.1 If center of landing dispersion is: 
within 3 -sigma NAV ellipse - GO 

between 3- and 6-sigma NAV ellipse - PM DISCRETION 
beyond 6-sigma NAV ellipse - ANOMALY PANEL 

GO 
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III. Entry Scenarios 


A. Timeline 

In order to describe the successful and failed entry scenarios, it is important to understand the sequence of events 
prior to entry. These events are listed in Table 2. 


Table 2. Nominal Timeline for Entry 


Time 

Event 

Entry -31.5 hours 

GO/NO-GO Decision for TCM-19 

Entry -28 hours 

TCM-19 - Stardust is targeted to eastern portion of UTTR 

Entry -2 1 hours 

Green Button 1 

Entry - 1 2 hours 

Execute Contingency TCM-19A/B 

Entry -6.5 hours 

Green Button 2 

Entry -4 hours 

Capsule Release or Divert 

Entry +0 

Entry Interface 

Entry +2:13 minutes 

Drogue Chute Deploy 

Entry +8:04 minutes 

Main chute deploy 

Entry +14:44 minutes 

Ground Landing 


TCM-19 (Trajectory Correction Maneuver) is listed as the first event, because it is the maneuver that points 
Stardust to land close to UTTR. Before this Stardust is aimed to skip through Earth’s upper atmosphere. For more 
detail on the entry trajectory or the Earth approach trajectory see Ref. 5 and 6, respectively. The Green Button 1 and 
2 mark meetings where a GO/NO-GO decision to continue with entry is made. If Stardust is NO-GO, the spacecraft 
performs an abort bum to a heliocentric orbit to come back to Earth for another attempt approximately 4 years later. 
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Once the space return capsule is released from the spacecraft bus at Entry-4 hours, there is nothing that can be done 
to modify the trajectory of the capsule. 

B. Succesful Scenario 

A successful entry scenario is when the sample return capsule lands within the nominal predicted landing ellipse 
under parachute. The requirements based on a successful landing are evaluated using the nominal landing ellipse 
computed from a Monte Carlo simulation of the entry trajectory (Ref. 5). The details of how to calculate the impact 
probability, casualty expectation, and probability of casualty from this ellipse are described in Section IV. 

C. Failure Scenarios 

Based on analysis of the events timeline in Table 2, failure scenarios that result in an Earth landing ellipse 
different than the nominal landing ellipse were identified. These include a separation failure or partial separation, an 
entry system failure, a chute failure, and a TCM-19 partial bum. A failure of the spring separation spin system, 
which imparted both a spin and a velocity increment to the capsule, can lead to an unstable entry due to a low spin 
rate or the bus still being attached to the capsule. An entry system failure, which includes failure of the thermal 
protection system, can lead to an aero-thermal breakup that causes debris to be scattered around the target. A chute 
failure will result in an intact capsule crash landing close to the target. A partial bum at TCM-19 (that cannot be 
corrected by a contingency TCM-19A/B or a divert) results in debris landing greater than 1,000 km downrange 
(southeast) of the target or in a trajectory that skips out of the atmosphere. The downrange distance obtained is 
dependent on the percentage of TCM-19 that would be completed. All of these failure scenarios, excluding TCM- 
19, were analyzed at the Green Button meetings. TCM-19 failure was analyzed as a separate analysis discussed in 
Section V. 

D. Failure Debris Impact Location and Ellipse Size 

It was desired to group these failure scenarios such that a simple, conservative analysis could bound the possible 
outcomes. The failure outcomes were qualified in terms of the impacting debris and the location and size of the 
impacting ellipse. 

There are two possible debris impact scenarios. One is an impact where the failure does not lead to a breakup 
and the entire vehicle hits the ground in one piece. The other has the vehicle breaking up during entry (due to aero- 
thermal forces) and spreading its debris around the targeted landing site. For this scenario a significant amount of 
work was performed to predict the vehicle breakup sequence (Ref. 7). If breakup does occur, only the 0.81 m 
diameter heatshield and nine tungsten ballasts could survive to impact. As a note, eight of the ballasts are in the nose 
of the capsule (~0.2 12 kg cubes with -2.23 cm sides) and one ballast is attached to the avionics deck (-0.25 kg 
cube with -2.5 cm sides). The reason for the survival of the heatshield is due to its heat-resistant design. The 
tungsten ballasts survive because of their extremely high melting temperature (3643 K). It is interesting that the 
tungsten was chosen as the ballast material because of its high density, and it was not needed for its high melting 
temperature properties. It is possible that if rigorous aero-thermal breakup and hazard analysis was performed 
during the pre-launch trajectory design it might have had an effect on the material that was chosen for the ballast. 
As it turned out the ballast debris caused particular concern in meeting the failure scenario hazard requirements. 
This risk mode could have been an eliminated if an a priori breakup analysis (showing that another ballast material 
would bum up during entry) was completed during capsule design. 

Depending on the debris impact scenario and the separation delta velocity imparted to the capsule, the mean 
landing locations and ellipse size can vary quite a bit. An analysis was done to establish bounds for where the intact 
capsule or surviving debris would land in the event of a failure. Combinations of the following scenarios were run to 
impact: intact landing, vehicle breakup, a separation system failure (0% release), and a perfectly performing 

separation system (100% release). Deck and nose ballast are called out separately because the nose ballasts are 
modeled to break off the capsule first and thus fly further downrange. Downrange is in the southeast (SE) direction, 
and uprange is in the northwest (NW) direction. 

Table 3 shows the impact locations relative to the mean of the nominal ellipse. The breakup scenarios result in 
the heatshield landing up to 60 km uprange of the nominal landing and the ballast landing as much as 168 km 
downrange. This variation is because the tumbling hypersonic continuum ballistic coefficient for the heatshield 
alone is -3 1 kg/m 2 , for the ballast it is -275 kg/m 2 , while for an intact tumbling capsule it is -105 kg/m 2 . 
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Table 3. Failure scenarios distance to the target 


Breakup scenario 

Release 

Debris 

Distance from mean debris landing 
point to mean nominal landing 
point 

Survives entry 

0% 

Intact capsule 

Downrange (SE) 30 km 

Bum-up & Breakup 

0% 

Deck Ballast debris 

Downrange (SE) 63 km 

Nose Ballast debris 

Dowrange (SE) 1 68 km 

Heatshield debris 

Uprange (NW) 3 1 km 

Survives entry 

100% 

Intact capsule 

0 km 

Bum-up & Breakup 

100% 

Deck Ballast debris 

Downrange (SE) 3 1 km 

Nose Ballast debris 

Dowrange (SE) 131 km 

Heatshield debris 

Uprange (NW) 59 km 


In order to mimic these failures, the debris ellipses were moved uprange and downrange along the incoming 
flight azimuth to represent possible debris landing locations. Based on Table 3, ellipses due to the heatshield or the 
intact capsule were moved uprange 70 km (59 km +11 km margin) in steps of 5 km. This movement is shown as 
red dots in Figure 3 and was called the heatshield debris line. The ballast ellipses were moved downrange by 200 
km (168 km + 32 km margin) in steps of 5 km. This is shown as blue dots in Figure 3 and is called the ballast debris 
line. Margins of 1 1 km and 32 km were included for conservatism based on engineering judgment and having 
numbers divisible by the 5 km step size in the hazard analysis. An argument could have been made that only the 
deck ballasts land close to the target (downrange <100 km), and the nose ballasts always land far downrange (> 100 
km). For conservatism, it was assumed any of the ballasts could land between 0 and 200 km from the target. 

For the heatshield debris line the same size ellipse as the nominal intact capsule ellipse is used. This assumption 
is based on Monte Carlo analysis that showed the ellipse for the heatshield alone is the same as the ellipse for the 
entry of the nominal intact capsule ellipse. An example ellipse at one of the analysis points is shown in red in Fig. 3. 
By using this same ellipse for both the nominal and heatshield ellipse, it saved computational time and complexity. 
For the ballast ellipse, a separate Monte Carlo was run that used ballast aerodynamics and resulted in a skinnier and 
longer ellipse. An example of this ellipse is shown in blue in Fig. 3. 

At each red or blue dot in Fig. 3, an ellipse of appropriate size centered on the dot was analyzed for E c and P c . 
The maximum E c or P c was computed from the uprange array of ellipses and the downrange array of ballast ellipses. 
For Ec, the two maximum values were then added to get the worst-case value for an entry. For P c , the maximum of 
the two maximum values was computed to get the worst-case entry value. This analysis process is in line with the 
conservative stance espoused in Section II where it was stated the worst-case failure was taken from the array of 
failure scenarios. 



Worst case Pc — 


Max Pc of heatshield 
/ debris ellipses analyzed 
Max \ 70 km uprange in 5 km 
intervals 


Max Pc of ballast debris 
ellipses analyzed 200 km 
downrange in 5 km 
intervals 


Figure 3. Cartoon of Breakup Scenarios to Compute Worst Case Failure 
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IV. Calculating Impact Probability, Casualty Expectation, and Probability of Casualty from a 

Bivariate Normal Ellipse 

Once landing ellipses are calculated based on the successful or failed entry scenarios they are fed into the 
process to calculate impact probabilities, casualty expectation, and probability of casualty for comparison against the 
requirements. All of the calculations for this process and for reduction of the landing points into ellipses are done 
with a scriptable hazard evaluation tool developed at the Jet Propulsion Laboratory. 

Requirements 1.17 and 4.1 are easily analyzed, because they restrict the location of the mean landing point of the 
nominal ellipse to be outside of the Dugway Keepout Zones and inside the navigation error ellipses. Success of 
these criteria is based on comparing the mean landing point to the area in question. The rest of the requirements are 
computed starting from an impact probability. 

A. Probability of Impact 

The impact probability for a bivariate normal ellipse landing on the i th area (A,), also called an area element, can 
be calculated by integrating the probability density function N(a x ,cr y ,p,p x ,p y ) as is shown in Eq. (2). 

PI, = f N(o x ,o y ,p,n x ,ii y ) (2) 

A, 

Where a x and a y are the ellipse standard deviations in a Cartesian coordinate system, p is the covariance of the 
statistical distribution, and p x and p y are the ellipse means in the Cartesian system. The integral is computed over 
the area element (A;) that also must be in the Cartesian system. Typically, for this calculation the area is given in 
terms of a list of latitude and longitude points. An ellipse is defined by it longitude/latitude mean impact point, 
ellipse azimuth, and the 99% crossrange and downrange ellipse axes are used to define the ellipses. The hazard 
evaluation tool has the ability to reconcile all of these inputs into a Cartesian frame and compute the impact 
probability for an arbitrary area anywhere on the globe. For analysis of Requirement 2.1, Eq. 2 is evaluated by 
integrating over the entire area within the Green Fence boundary using the nominal landing ellipse as the bivariate 
normal ellipse. 

B. Casualty Area 

The casualty area (A c ) is the area within which an unprotected person will be hit by debris. This value is 
important to assess both casualty expectation and probability of casualty. The casualty area is based on the shape of 
the debris, the impact state, and the size of the target (which in this case is a person). There are three types of debris 
being tracked: an intact capsule, the heatshield, and the ballasts. A circle, with radius (r), represents the largest 
impacting cross sectional area of the heatshield and capsule. The ballasts, which are nearly cubes with a side (s), are 
represented by a square. To each of these areas a 0.3 m person border (r p ) is added, which represents a person 
standing up viewed from above. Based on this the casualty areas for a circular projected area and a rectangular 
projected are shown in equations (3) and (4), respectively. 

A c=Nf I f Jt(r + r p ) 2 (3) 

A c =NfIf(s+2r p ) 2 (4) 

Nf is the number of fragments. For the ballasts this is set to eight and for the intact capsule or heatshield it is set 
to one. The impact factor (I f ) is a safety factor used to represent debris impact splatter, skid, bounce, ricochet, and 
cratering effects based on Ref. 8. For conservatism, a value of 2 is chosen for this impact factor (If). This value is 
considered conservative because the debris will be falling nearly vertical when it hits the ground and will have little 
skid or ricochet. Population sheltering was not used in the calculation of the casualty area. Based on these 
parameters the casualty area for the intact capsule or the heatshield is 3.75 nr and the casualty area for the eight 
ballasts is 5.76 m 2 . A decision was made to leave the deck ballast out of the calculation of the ballast casualty area, 
which reduces the number of ballasts to eight. Assuming that the single deck ballast lands in the same location as 
the other eight was considered to be unrealistic given the fact that in breakup analysis it always landed much further 
uprange than the other eight. Adding a ninth ballast would increase the ballast E c and P c by 1 1%. 
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C. Casualty Expectation and Probability of Casualty 

Requirements 1.1 through 1.16 are based on casualty expectation and probability of casualty. E c and P c were 
briefly described in Section II, however, here is a more thorough description of the terms, and a short description of 
how to compute them from the impact probability in Eq. 2. 

Casualty expectation is the number of people estimated to be casualties of an entry event. For our purposes a 
casualty is defined as someone hit by debris. Someone might ask, “During the Stardust entry how many people are 
going to be hit by debris?” The answer to this is the casualty expectation. Typically, casualty expectation is much 
less than one. For example, a casualty expectation of le-6 people means that for every million entries one person 
will be a casualty. As with all risks, casualty expectation is measured as the probability times a consequence. In our 
case, the probability is that of landing in a particular area, shown in Eq. 2. The consequence is measured as the 
population density times the casualty area (A c ). The equation for E c for an arbitrary area element (A;) with 
population (Pj) can be written as Eq. 5. 


E a = PI Ac 


(5) 


The area element is chosen based on a population database. Because population databases have multiple areas, 
the total casualty expectation for a single ellipse can be written as a summation of the casualty expectations for all of 
the area elements as is shown in Eq. 6. 



( 6 ) 


The probability of casualty is the probability that at least one person will be a casualty of debris. A person who 
lives just east of UTTR might ask, “What are my chances of being hit by debris during the Stardust entry?” The 
answer to this is the probability of casualty for their area. The probability of casualty is only analyzed for area 
elements that have a population of at least one person, and is written in Eq. 7 as the probability of impacting the area 
element times the ratio of the casualty area to the area element. 


P = 


PL A 

A. 


(7) 


The probability of casualty for a single ellipse is analyzed for each area element in the population database. To 
obtain the value to compare against the requirements Eq. 8 is used for a single ellipse. 

P c = max, .(/A) (8) 


D. Population 

The last input needed for the calculation of E c and P c is the population density for the area elements in Eq. 2 and 
5. As was stated in Section II the population databases approved by NASA and UTTR are different. The NASA 
database contains data for a much larger area, whereas the UTTR database focuses on the immediate area around 
UTTR. Both UTTR and NASA use the same database to represent the population supporting the mission on UTTR. 
The NASA approved population is maintained by the Oak Ridge National Laboratory and is called the LandScan 
database. It is based on Census data, satellite imagery, correlation with roads, and other data sources (Ref. 9). The 
original database is a 30 arc-second grid, however, it was reduced to 2 arc -minute quadrangles shown in Fig. 4. The 
population cells in Fig. 4 are plotted with different colors representing population densities. Green, yellow, orange, 
and red represent high densities (> 100 people/km 2 ). This shows that there is very little population to the west of 
UTTR, and to the east population increases towards Salt Lake City. The UTTR developed database is shown in Fig. 
5. The population cells shown in red have various shapes and range from 1-3500 people. Also in Fig. 5 are two 
blue population cells that represent the population to support the mission. 
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Figure 4. LandScan Population 
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Figure 5. UTTR Population 
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V. Hazard Analysis in Mission Planning 

Three analyses are introduced in this section that helped clear the way for the Stardust landing and selection of a 
robust targeted impact point. These analyses are the computation of casualty expectation from a TCM-19 failure, 
the evaluation of the target site based on impact probabilities on UTTR, and casualty expectation risk due to vehicle 
breakup scenarios. 


A. TCM-19 Failure 

The failure of TCM-19 had to meet Requirement 1.14 with a casualty expectation of less than 1.67e-3 people. A 
TCM-19 failure results in debris scattered as far downrange as Oklahoma. Figure 6 shows the movement of the 
debris impact point track in yellow as a function of the percentage of TCM-19 completed. As more of the bum 
completes, the further uprange and closer to UTTR the impact track moves. If the less than 53% of TCM-19 is 
completed, the vehicle skips out of the atmosphere. Also shown in Figure 6 are the nose ballast ellipses for 53%, 
66%, 80%, 95%, and 100% completion of TCM-19. The population density data underneath the ground track is also 
shown. 

The analysis to prove that TCM-19 would meet Requirement 1.14 assumed the failure would be distributed 
uniformly with time, and would occur somewhere along the TCM-19 impact point track. It also assumed that in this 
scenario the vehicle would breakup because of the incorrect entry flight path angle that would be associated with an 
incomplete TCM-19. The casualty expectation for the resulting heatshield and ballast debris ellipses integrated over 
the impact point track was computed as ~2e-4 people, which is an order of magnitude below Requirement 1.14. 
These results were also validated with help from Johnson Space Center and The Aerospace Corporation. Because 
this requirement was not violated approval was given to execute TCM-19. 
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Figure 6. Ballast Impact 99% Ellipses for Partial TCM-19 Ranging from 53-100% 
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B. Target Site Selection 

The target site selection analysis was perfonned to graphically represent areas to target or avoid based on a 
nominal 99% ellipse of 76 x 44 km at 104 deg azimuth. This size ellipse was used because at the time of the 
analysis it was the best prediction of the nominal ellipse. The areas to target were identified by contouring ellipses 
(Ref. 1). The nominal ellipse was moved throughout UTTR and evaluated for the probability of impacting UTTR, 
land hazards, Department of Defense (DoD) land, and what was called the Yellow Divot. Contours could then be 
drawn at the desired impact probability to mark areas where Stardust should target or avoid. As an example, shown 
in green in Fig. 7 is the contour for a 95% (green) probability of landing inside the Green Fence. If the center of the 
ellipse was inside the green line, Stardust would have a >95% chance of landing inside the Green Fence, and would 
meet Requirement 1.17. Therefore, it was desirable to choose a target inside the green line. Land hazards, which 
were not represented as formal requirements in Table 2, are shown in Fig. 7 as red hash marks. Contours are drawn 
for a 99% chance of not landing on these hazards. The center of the ellipse was kept outside of these red contours. 
Another desire was to land on Department of Defense (DoD) land shown in blue in Fig. 7. The 95% impact 
probability contour for this area is shown as a blue contour. The Yellow Divot, described in Section IIIC, was an 
undesirable place to land. The Y ellow Divot contour shown was calculated to give a 99% chance of landing outside 
of the Yellow Divot. The white ellipse in Fig. 7 is shown at the targeted landing location of 40.3167°N (40°19’N) 
geodetic latitude and 246.5500°E (246°33’E) longitude. Figure 7 shows how the target choice balanced the 
requirements for this size ellipse. The ellipse center is inside the Green Fence (green contour) and DoD contours 
(blue contour), outside the land hazards contour (red contour), and just on the edge of the Y ellow Divot contour 
(yellow contour). These results were combined with other operational and technical consideration for final choice of 
the landing site. 

245*30’ 245*45' 246*00’ 246*15' 246*30' 246*45' 24/00' 24/15' 24/30' 

40*45' 


40*30' 


40*15' 


40*00’ 


39*45' 

245*30' 245*45' 246*00' 246*15' 246*30' 246*45' 24/00' 24/15' 24/30' 

Legend 

White Ellipse - 76 x 44 km at 104 deg ellipse 
Keep Out Zones 
HU Land Hazards 
Yellow Divot 
Keep In Zones 
— UTTR Green Fence 
— DOD Land 

Figure 7: Finding the Sweet Spot at UTTR 
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C. Risk from Breakup Debris 

Requirements 1.10 and 1.14 set the casualty expectation for a vehicle breakup failure scenario. The 
methodology used for this calculation was established in Section III and is based on debris lines originating at the 
nominal impact point. It was important to capture how risk from the debris lines changed with the movement of the 
nominal impact point to ensure there were no areas around the target where a violation of the requirements occurred. 
Only the downrange ballast debris was analyzed, since there was significantly less population uprange than 
downrange. 

Because the maximum casualty expectation was used from a series of ellipses along a 200 km downrange ballast 
debris line, the main sensitivity of debris casualty expectation was to crossrange changes. To see this sensitivity, the 
ballast debris line was moved in a positive and negative crossrange direction from the targeted landing site, as is 
shown with the arrows in the top half of Fig. 8. Example debris lines are shown in Fig. 8 at the target (green), 27 km 
NE of the target (red), and 20 km SW (blue) of the target. The value of the casualty expectation was based on 
LandScan population and a 99% 56x6 km ballast debris ellipse. The casualty expectation is shown in the bottom 
half of Fig. 8 as a function of crossrange. As the debris line moves to the NE (positive crossrange), the casualty 
expectation increases until at +27 km there is a violation of Requirement 1.14. The debris line for this violation is 
shown in red on the top half of Fig. 8. This increase in casualty expectation is due to the population increasing as 
the debris line moves NW. The area where this violation occurs was cut out of the Green Fence and dubbed the 
Yellow Divot. The Yellow Divot, shown here in yellow, is slightly different than the one in Fig. 7, which was 
generated based on a stricter Requirement 1.14. The orange contour in the top half of Fig. 8 represents areas where 
the debris line could not cross into without causing a violation of Requirement 1.14. The +27 km crossrange debris 
line skirts the edge of this orange contour. 

Figure 9 shows results for the same crossrange sensitivity, but uses the UTTR population database. In this 
scenario population centers just SW of the target called the Dugway population centers were of biggest concern. As 
can be seen in the bottom half of Fig. 9, for a 99% 45 x 6 km ballast ellipse there is a peak casualty expectation of 
2.4e-4 people at 4 km SW of the target. This value approaches but does not violate Requirement 1.10 of 5e-4 
people. The debris line for this peak is shown as a magenta line on the top half of Fig. 9, and can be seen cutting 
right through the Dugway populations. A ballast ellipse size of a 20 x 6 km ellipse at 4 km SW of the target would 
cause a violation of this requirement. The final Green Button 2 ballast ellipse size was 45 x 6 km and -3 km 
crossrange from the target. Because of the debris ellipse size and location, this requirement caused particular 
concern during the Green Button meetings. Combining the results of Fig. 9 with the knowledge that the ballast 
ellipse would not shrink to 20 x 6 km, it was shown the Requirement 1.10 would not be violated. The high risk 
numbers in Fig. 9 also resulted from the conservative assumption that all of the ballasts could land less than 100 km 
downrange of the target. The analysis actually showed that only the deck ballast would land in UTTR and all other 
eight ballasts would land much further downrange. In retrospect, if a casualty area representing only the single deck 
ballast was used for the ellipses that were less than 50 km downrange, these high results could have been avoided. 
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Figure 8: Downrange LandScan Population Hazards Due to Ballast Debris 
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Figure 9: UTTR Population Hazards Due to Ballast Debris 
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VI. Hazard Analysis in Mission Operations 

Green Button meetings 1 and 2 were the two most important times that the hazard analysis was performed. This 
was because the GO/NO-GO decisions at these events were partly based on the hazard results. Leading up to the 
Green Button 1 and 2 decisions there was a compressed timeline. The entry, descent, and landing analysts had 1.5 
hours to run over 6,000 trajectories, analyze hazards for successful/failed entry scenarios, and compare them to the 
requirements. Much effort was spent practicing and streamlining this operation. 

Table 3 shows the size and location of the Green Button ellipses, and Table 4 shows the requirement results for 
these ellipses. The center of the Green Button 2 nominal ellipse was only 7 km away from the desired target. The 
only criteria that came close to a violation was 1.10, due to that ellipse being centered ~3 km in crossrange away 
from the target. This was near the peak of the UTTR risk as was shown in Section V. 


Table 3. Summary of Final Green Button Ellipses 



Green Button #1 

Green Button #2 

Geodetic latitude 

40.3025 degN 

40.3048 degN 

Longitude 

246.4845 deg E 

246.4653 deg E 

99% Ellipse Size 

53 km x 19 km at 104 deg 

48 km x 19 km at 104 deg 


Table 4: Hazard Values for Green Button Decisions 


Requirement 

Criterion 

Green 
Button #1 
(E-21 hr) 

Green 
Button #2 
(E-6.5 hr) 

Human Safety - Succesfui Entry 

1.1 Landing points meet UTTR Pc, public individual 

< le-7 

5.28e-12 

2.59e-12 

1 .2 Landing points meet UTTR Ec , public collective (people) 

< 3e-5 

7.26e-l 1 

1.53e-l 1 

1 .3 Landing points meet UTTR Pc, mission individual 

< 3e-6 

3.75e-10 

1.83e-10 

1 .4 Landing points meet UTTR Ec, mission collective (people) 

< 3e-4 

2.62e-09 

1.28e-09 

1.5 Landing points meet NASA Pc, public individual 

< le-6 

6.84e-10 

2.82e-10 

1.6 Landing points meet NASA Ec, public collective (people) 

< le-4 

4.84e-08 

1.46e-08 

1.7 Landing points meet NASA Pc, mission individual 

< le-5 

3.75e-10 

1.83e-10 

1.8 Landing points meet NASA Ec, mission collective (people) 

< 3e-4 

2.62e-09 

1.28e-09 

Human Safety - Failure Scenario (a.ka. Yellow Divot) 

1 .9 Landing points meet UTTR Pc, public individual 

< 1.67e-6 

6.99e-08 

7.96e-08 

1.10 Landing points meet UTTR Ec, public collective (people) 

< 5e-4 

2.38e-04 

2.71e-04 

1.11 Landing points meet UTTR Pc, mission individual 

< 5e-5 

3.75e-10 

1.83e-10 

1.12 Landing points meet UTTR Ec, mission collective (people) 

< 5e-3 

2.62e-09 

1.28e-09 

1.13 Landing points meet NASA Pc, public individual 

< 1.67e-5 

6.82e-08 

7.53e-08 

1.14 Landing points meet NASA Ec, public collective (people) 

< 1.67e-3 

6.17e-05 

6.44e-05 

1.15 Landing points meet NASA Pc, mission individual 

< 1.67e-4 

3.75e-10 

1.83e-10 

1.16 Landing points meet NASA Ec, mission collective (people) 

< 5e -3 

2.62e-09 

1.28e-09 

Property Damage 

1.17 Center of landing dispersion is outside of all 1 nmi radius 
UTTR property zones 

Yes 

Yes 

Yes 

Landing Site 

2.1 Landing points in Acceptable Landing Region above 95% 
below 75% - NO GO 
between above - ANOMALY PANEL 

>95% 

100% 

100% 

SRC Capability 

3.1 Entry Flight Path Angle within [-8.05°, -8.35°] to 99% 
beyond [-7.83°, -8.57°] to 99% - NO GO 
between above - ANOMALY PANEL 

> 99% 

> 99% 

100% 

100% 

100% 

100% 

Warning Track 

4.1 If center of landing dispersion is: 
within 3 -sigma NAV ellipse - GO 

between 3- and 6-sigma NAV ellipse - PM DISCRETION 
beyond 6-sigma NAV ellipse - ANOMALY PANEL 

GO 

GO 

GO 
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Figure 10: Final Predicted ellipse with Actual Landing Point 

A plot of the Green Button 2 ellipse is shown in Fig. 10 in green. The actual Stardust landing point shown as a red 
cross was inside the Green Button 2 ellipse. The events leading to this impact point are discussed in Ref. 5. 
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